The Information Commissioner’s Office (ICO) said it had significant concerns about the programmatic advertising process known as real-time bidding (RTB), which makes up a large chunk of online advertising.
It said that systematic profiling of web users via invasive tracking technologies such as cookies is in breach of the UK and pan-EU privacy laws.
“The adtech industry appears immature in its understanding of data protection requirements. While the automated delivery of ad impressions is here to stay, we have general, systemic concerns around the level of compliance of RTB.”
The UK watchdog has not yet issued a formal legal decision against RTB. But it is warning that it will take action if something does not change soon.
The watchdog is said that non-special category data processing was illegal at the point of collection due to the mistaken perception that legitimate interests can be used for placing or reading a cookie or other technology, The law says you have to obtain consent.
Special category data processing was taking place unlawfully as explicit consent is not being collected and no other condition applies. In general, processing such data requires more protection as it brings an increased potential for harm to individuals.
Sensitive personal data - such as political views, health information, sexual orientation) was being processed by the behavioural advertising industry. Under UK and EU law, handling this sort of information requires a higher standard of explicit consent, given there are much greater risks of harms were it to be misused or go astray.
The ICO says it believes the adtech industry has failed to do due diligence because it’s found companies haven’t even bothered to carry out data protection impact assessments (DPIAs). That, in turn, suggests they haven’t even tried to get a handle on privacy risks, and therefore are demonstrably not making any effort to try to reduce those risks..
Privacy polices and consent pop-ups are horribly confusing — which means internet users have little hope of providing informed concent.
The ad industry is creating profiles about individuals that are extremely detailed and are repeatedly shared among hundreds of organisations for any one bid request, all without the individuals’ knowledge.
The behavioural advertising industry’s mass surveillance of web users results in all of us being profiled in crazy detail routinely handed off to, at least, hundreds of companies who are involved in the adtech chain every time there’s a programmatic ad transaction.
